A flaw was found in the kubevirt-csi component of OpenShift Virtualizations Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker nodes volume by creating a custom Persistent Volume that matches the name of a worker node.
The product mixes trusted and untrusted data in the same data structure or structured message.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openshift_container_platform | Redhat | 4.13 (including) | 4.13 (including) |
| Openshift_container_platform | Redhat | 4.14 (including) | 4.14 (including) |
| Openshift_container_platform | Redhat | 4.15 (including) | 4.15 (including) |
| Openshift_container_platform_for_arm64 | Redhat | 4.13 (including) | 4.13 (including) |
| Openshift_container_platform_for_arm64 | Redhat | 4.14 (including) | 4.14 (including) |
| Openshift_container_platform_for_arm64 | Redhat | 4.15 (including) | 4.15 (including) |
| Openshift_container_platform_for_ibm_z | Redhat | 4.13 (including) | 4.13 (including) |
| Openshift_container_platform_for_ibm_z | Redhat | 4.14 (including) | 4.14 (including) |
| Openshift_container_platform_for_ibm_z | Redhat | 4.15 (including) | 4.15 (including) |
| Openshift_container_platform_for_linuxone | Redhat | 4.13 (including) | 4.13 (including) |
| Openshift_container_platform_for_linuxone | Redhat | 4.14 (including) | 4.14 (including) |
| Openshift_container_platform_for_linuxone | Redhat | 4.15 (including) | 4.15 (including) |
| Openshift_container_platform_for_power | Redhat | 4.13 (including) | 4.13 (including) |
| Openshift_container_platform_for_power | Redhat | 4.14 (including) | 4.14 (including) |
| Openshift_container_platform_for_power | Redhat | 4.15 (including) | 4.15 (including) |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/kubevirt-csi-driver-rhel8:v4.13.0-202404200313.p0.g9d909f7.assembly.stream.el8 | * |
| Red Hat OpenShift Container Platform 4.14 | RedHat | openshift4/kubevirt-csi-driver-rhel8:v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8 | * |
| Red Hat OpenShift Container Platform 4.15 | RedHat | openshift4/kubevirt-csi-driver-rhel8:v4.15.0-202403220332.p0.gd3bdbce.assembly.stream.el8 | * |